According to a method well-known in the Pay-TV field, the audio/video data of a broadcast stream is encrypted by a provider by means of encryption keys called control words. This data is transmitted to user units or set top boxes connected to a display or television set. The control words are transmitted to these user units via a stream of control messages often in parallel of the audio/video data stream, each control message comprising at least one control word.
The user units are generally made up of processing units capable to decode the received audio/video data stream by using a security module designed to be to same extent tamperproof, and securely configured to perform cryptographic operations related to the processing of the audio/video data.
A security module may take several distinct forms: a first form includes a microprocessor card, a smart card, or more generally an electronic module (in the form of a key, a badge, a dongle, etc. . . . ). This type of security module is generally removable and can be connected to the user unit via electrical contacts and/or a contactless connection interface, for example of ISO 14443 type or NFC type (Near Field Connection) or the like.
A further known form is an integrated circuit placed, often in a irremovable way, in the user unit. An embodiment could comprise a circuit welded on a printed circuit board or a circuit plugged in a connector, such as for example a SIM module connector or the like.
According to a further embodiment, the security module may be integrated into an integrated circuit having also other functions, for example in a descrambling module or in the main microprocessor of a set top box.
In a further embodiment, the security module is not implemented in a particular hardware module, but rather its functionalities are integrated in the form of software only.
When a user unit receives a stream containing the control messages, user access rights are verified by comparing rights stored in the security module with rights contained in the control messages. A successful verification enables extraction of the control word from the control message allowing decryption of the audio video content data. As known, each control word generally allows decryption of a small part of the broadcast encrypted data. Typically, one control word allows decrypting 10 seconds of a Pay-TV program. This time duration, called a cryptoperiod, defines a period after which the control word changes for security reasons.
One notorious method to share with other users an access to encrypted data without being authorized consists of using a genuine user unit, with a real security module, to receive and distribute control words to a set of other non validated or unauthorized user units. This distribution may be performed, for example, via a server or a specific device sometimes called a splitter. When this type of piracy, known sometimes as control word sharing, is implemented, the price related to the access rights acquisition is paid by only a single unit while the audio video content is accessible by several more unauthorized user units.
Document EP1575293A1 describes a method intended to prevent a security module from being shared by several users. According to this method, the security module comprises a memory for storing control message sequences and means for analyzing an abnormal command message sequence by comparison with the stored control messages. When an abnormal sequence is detected, an error counter is incremented. A time delay in the processing of the control words is introduced according to the value of the error counter. The abnormal behavior is defined on the basis of the analysis of the used channels. As for example, if the channel identifier varies alternatively from A to B, the analysis means interprets such a behavior as an abnormal sequence related to security module sharing. The error counter is then incremented. On the contrary, when the channel identifier is A for several cryptoperiods, then passes to B for several further cryptoperiods, the analysis means will not consider this behavior as abnormal and the error counter will not be incremented.
Document U.S. Pat. No. 7,552,457B2 discloses also a method to prevent fraudulent use of control words wherein each time a multimedia unit receives a control message, the unit, or the associated security module, determines to which channel this control message is related. The channel identifiers are stored together with a time information. The messages are compared in order to determine if they are related to different channels or to the same channel. If they are related to different channels, a counter is incremented by a given value. If the control messages are related to the same channel, the counter is decremented. If the counter reaches a predetermined threshold value, this means that many channel changes have occurred and control words decrypting is stopped.
The processes described in the documents EP1575293A1 and U.S. Pat. No. 7,552,457B2 imply that an identifier of the channel concerned for each control message is necessary. Certain configurations do not require the channel identifier, in particular by using the control messages as defined in the Eurocrypt N° EN 50094 standard of December 1992, it is possible to identify a class of channels rather than each individual channel. In this case, the above described processes do not allow blocking the use of several multimedia units operating with only one security module and a splitter.
As is well-known, control messages are typically repeated according to very short time intervals, for example 50 ms. The aim of this is to make the control word necessary for access to the contents rapidly available when channel changing or zapping. When a user unit has received a control message, it typically filters the identical messages in such a way that the control messages are only forwarded to the security module once. A difficulty arises when the control messages contain more than one control word. In practice, two control words are often sent per control message. The advantage of the approach used in the typical systems described lies in the fact that while one of the control words is used, the other is decrypted and memorized. This scheme thus allows using safer decrypting algorithms.
In such a case, it is possible for a fraudulent user to use only one control message of two, then to transmit the unused message to another user unit or processing device. In this way, each user unit receives all the required control words. Therefore, several processing units can allow access to encrypted content while in theory only one subscriber is authorized. This type of fraud is particularly difficult to detect since it is impossible, without using a channel identifier, to distinguish a normal use of all control messages by only one user unit from fraudulent use by two different user units of one control message.